CVE-2025-65672
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
An Insecure Direct Object Reference (IDOR) vulnerability in classroomio 0.1.13 allows unauthorized access to share and invite features in course settings.
Risk Assessment
An attacker can gain unauthorized access to course sharing and invitation functions, potentially leading to data confidentiality and integrity breaches.
Recommendation
Immediately update classroomio to the latest version and implement access control mechanisms based on user authorization.
Other vulnerabilities in classroomio
See all- CVE-2025-65669Critical
In classroomio 0.1.13, student accounts can delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction.
- CVE-2025-65670Medium
An IDOR vulnerability in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in temporary unauthorized disclosure of sensitive course, admin, and student data before the system reverts to normal access restrictions.
Original NVD description (English source)
Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.